Watermark Unit for AI Model Authenticity Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a lack of effective digital rights protection for artificial intelligence models and a lack of proof that results produced by data processing accelerators are protected by a 'root of trust' system, making it difficult to ensure the authenticity and trustworthiness of AI model inferences.
Innovation Solution
The implementation of a watermarking system within AI models, where a watermark is embedded or inherited during training and inference processes, allowing the host device to validate the AI model's authenticity and associate inferences with the correct model, using watermark-enabled kernels that can extract, implant, and digitally sign data to ensure trustworthiness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If AI models are deployed for inference without watermarking, then processing speed and ease of operation are improved, but digital rights protection and model authenticity verification deteriorate
Solution Approach 1:
The watermark is embedded into the AI model during the training phase before deployment. This preliminary action ensures that authenticity verification capabilities are already built into the model, eliminating the need for additional verification steps during inference while maintaining digital rights protection.
Solution Approach 2:
The watermark acts as an intermediary element embedded within the model parameters that enables authenticity verification without interfering with the model's primary inference function. The watermark carrier allows verification of model integrity while maintaining normal processing operations.
2Reliability
If watermarking is embedded during AI model training, then digital rights protection is improved, but training time and computational resources increase
Solution Approach 1:
The watermark embedding process is merged with the existing model training workflow. The watermark is integrated into the model parameters during the same training iterations used to learn the primary task, combining two functions into a single process without requiring separate training runs.
Solution Approach 2:
The training process serves multiple functions simultaneously: it learns the primary AI task while also embedding authenticity verification capabilities through watermarking. This multi-functionality reduces overall time loss by accomplishing both objectives in parallel rather than sequentially.
3Reliability
If watermark verification is performed on AI model inferences, then digital rights protection is improved, but processing throughput and productivity decrease
Solution Approach 1:
The AI model performs self-verification through its embedded watermark, eliminating the need for external verification systems. The model inherently carries its own authenticity proof, allowing verification to occur without additional processing steps that would reduce throughput.
Solution Approach 2:
The authenticity verification capability is extracted from the inference process and embedded within the model parameters themselves. This separation allows the verification function to operate independently without adding computational overhead to the primary inference task.
4Reliability
If watermark embedding is implemented in DP accelerators, then security and reliability are improved, but device complexity increases
Solution Approach 1:
The watermark embedding functionality is implemented as a localized feature within specific components of the DP accelerator architecture rather than requiring system-wide modifications. This targeted approach embeds security capabilities in specific training and inference units without complicating the entire device.
Solution Approach 2:
The watermark embedding capability is nested within the existing DP accelerator architecture, utilizing existing hardware resources and data flow paths. The security function is embedded as a sub-component of the primary processing units, avoiding the need for separate dedicated security hardware.
Data Source
AI summary
In one embodiment, a computer-implemented method performed by a data processing (DP) accelerator, the method includes receiving, at the DP accelerator, first data representing a set of training data from a host processor and performing training of an artificial intelligence (AI) model based on the set of training data within the DP accelerator. The method further includes implanting, by the DP accelerator, a watermark within the trained AI model and transmitting second data representing the trained AI model having the watermark implanted therein to the host processor. In an embodiment, the method further includes receiving a pre-trained machine learning model; and performing training for the pre-trained AI model based on the set of training data within the DP accelerator.